What We’ve Done Setup Tripwire ▫yum install tripwire ▫twadmin –m G –S./site.key ▫twadmin –m G –L./$HOSTNAME-local.key Configure Policy ▫Remove all “file/dir not exists” warnings ▫Change “scan the individual reports” to “yes” ▫Add rule: check ‘/’ recursively, mode=SEC_CRIT ▫Remove all rules that conflict with the added rule
Alert Policy File is NOT Secure!!! ▫even if “twpol.txt” is deleted can be retrieved using “twadmin –print-polfile” without any password. Of course, we’ve got all the others’ policy file. And did a little analysis.
Damages Made on All Create /media/canyouseeme Create /lost+found/.history Change modification time of /etc/yp.conf "05:27:09 " Change file /var/log/maillog ▫change a "localhost" to "l0calhost" and keep the original modification time.
+Damage Made on Add 'cat' to /var/lib/tripwire/report/ twr chmod 777 /etc/X11 Installed Kate
+Damage Made on Add 'cat' to /var/lib/tripwire/report/ twr chmod 777 /etc/X11
+Damage Made on Change modificatoin time of /var/log/samba/old "05:27:09" Change a "session" to "s3ssion" in /var/log/secure and keep the original modification time Change "=" to "-" in /etc/xml/catalog
Changes Found on Our Machine All files in “/etc/tripwire” are gone ▫rm –f *.* “localhost.localdomain.twd” changed ▫add “forensics” “.bash_profile” changed ▫add “/tmp/ttyconsole&” Create shortcut./cdrom ▫ln -s /usr/bin/./cdrom Added a new user called “helpless” ▫useradd helpless
Changes Found on Our Machine (Cont.) Installed airsnort.i386 and all of its dependencies ▫yum install airsnort.i386 Changed permissions on etc directory to 757 ▫chmod 757 etc/ Made directory /root/.enlightenment Added file /root/.enlightenment/.IgnoreMe! ▫wrote the date to this file
Changes Found on Our Machine (Cont.) Installed lrk4 and all of its dependencies Added /var/tmp/... Added /var/tmp/.../.... Added/etc/... Added /etc/.../.... Added /tmp/... Added /tmp/.../.... Added /tmp/tty-console Added /tmp/.. Added /... Added /.../....
Changes Found on Our Machine (Cont.) Added: /root/.tmp Added: /root/d Threw “lrk4.src.tar.gz” into Trash Added: /root/d Deleted: /var/lock/subsys/sendmail
Other Changes Installation of programs also modified system logs and configuration files. Create new user also automatically generate a list of files by system. Using gnome environment (Firefox, etc.) created and modified lots of log and configuration files, leaving some stuff in the cache.